NinjaForms < 3.5.8.2 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

PoC

With the Form Builder "Dev Mode” setting enabled, create a form and a field, then under the Display option of the field, add the following payload in the Custom Class Names Container field "> Save the field and form then view/preview the page with the form embed to trigger the XSS https://www.youtube.com/watch?v=Ax8QK5gEBUk